memo_assurance_cybersecurity¶

SysML API


Public namespace	`memo::assurance::cybersecurity`
Declared package	`memo_assurance_cybersecurity`
Source	`src/assurance/cybersecurity/memo_cybersecurity.sysml`

Namespace hierarchy¶

memo → memo::assurance → memo::assurance::cybersecurity

Packages¶

Package
`memo_assurance_cybersecurity`

Imports¶

Visibility	Target
private	`Metaobjects::SemanticMetadata`
private	`ScalarValues::*`
private	`memo_core_relationships::*`
private	`memo_core_common::*`
private	`memo_core_enumerations::*`
private	`memo_assurance_requirements::*`
private	`memo_assurance_safety_risk::*`
private	`memo_assurance_verification_validation::*`
private	`memo_architecture_operational_scenarios::*`
private	`memo_architecture_implementation_software_structure::SBOMEntry`

Declarations¶

Name	SysML kind	Description	Specializes
`CybersecurityAsset`	`part def`	Cybersecurity asset definition specializing `MemoPart`.	`MemoPart`
`AttackSurface`	`part def`	Attack surface definition specializing `MemoPart`.	`MemoPart`
`Threat`	`part def`	Threat definition specializing `RiskDriver`.	`RiskDriver`
`Vulnerability`	`item def`	Vulnerability definition specializing `RiskItem`.	`RiskItem`
`CyberHazard`	`item def`	Cyber hazard definition specializing `Hazard`.	`Hazard`
`CyberRisk`	`part def`	Cyber risk definition specializing `Risk`.	`Risk`
`CyberMitigation`	`part def`	Cyber mitigation definition specializing `RiskControlMeasure`.	`RiskControlMeasure`
`SecurityRequirement`	`requirement def`	Security requirement definition specializing `Requirement`.	`Requirement`
`TrustBoundary`	`part def`	Trust boundary definition specializing `InterfaceElement`.	`InterfaceElement`
`ThreatActorKind`	`enum def`	Controlled values for threat actor: `insider`, `serviceTechnician`, `opportunistic`, `cybercriminal`, `nationState`, `supplyChain`.	—
`ThreatCapabilityKind`	`enum def`	Controlled values for threat capability: `low`, `moderate`, `high`, `advanced`.	—
`ThreatAccessKind`	`enum def`	Controlled values for threat access: `physical`, `local`, `network`, `remote`, `supplyChain`.	—
`AttackTechniqueFrameworkKind`	`enum def`	Controlled values for attack technique framework: `mitreAttackIcs`, `mitreEmb3d`, `capec`, `other`.	—
`SecurityObjectiveKind`	`enum def`	Controlled values for security objective: `confidentiality`, `integrity`, `availability`, `authenticity`, `accountability`, `privacy`, `safety`.	—
`CyberAssumptionValidityKind`	`enum def`	Controlled values for cyber assumption validity: `valid`, `reviewDue`, `invalid`, `retired`.	—
`VulnerabilityDispositionKind`	`enum def`	Controlled values for vulnerability disposition: `open`, `mitigated`, `accepted`, `closed`.	—
`SecurityFindingStatusKind`	`enum def`	Controlled values for security finding status: `open`, `inRemediation`, `accepted`, `closed`.	—
`PostmarketProcessKind`	`enum def`	Controlled values for postmarket process: `monitoring`, `vulnerabilityDisclosure`, `patching`, `incidentResponse`.	—
`CyberRiskAssessmentStageKind`	`enum def`	Controlled values for cyber risk assessment stage: `inherent`, `residual`.	—
`ThreatActor`	`part def`	Threat actor definition specializing `MemoPart`.	`MemoPart`
`AttackTechnique`	`part def`	Attack technique definition specializing `MemoPart`.	`MemoPart`
`SecurityProperty`	`part def`	Security property definition specializing `MemoPart`.	`MemoPart`
`CybersecurityAssumption`	`part def`	Cybersecurity assumption definition specializing `MemoPart`.	`MemoPart`
`AttackPath`	`action def`	The path's narrative is the inherited `pathSummary`.	`OperativeScenario`
`SecurityAssessmentMethodKind`	`enum def`	Controlled values for security assessment method: `penetrationTest`, `sast`, `dast`, `sca`.	—
`SecurityAssessmentCase`	`verification def`	Security assessment case definition specializing `VerificationCase`.	`VerificationCase`
`SecurityFinding`	`part def`	Security finding definition specializing `MemoEvidence`.	`MemoEvidence`
`SecurityAssessmentReport`	`part def`	Security assessment report definition specializing `MemoEvidence`.	`MemoEvidence`
`PostmarketProcess`	`action def`	Postmarket process definition specializing `MemoAction`.	`MemoAction`
`CyberRiskAssessment`	`part def`	Cyber risk assessment definition specializing `MemoPart`.	`MemoPart`
`ThreatenedBy`	`connection def`	Typed relationship from `CybersecurityAsset` to `Threat`.	`MemoRelationship`
`Exploits`	`connection def`	Typed relationship from `Threat` to `Vulnerability`.	`MemoRelationship`
`RealizedByScenario`	`connection def`	Typed relationship from `RequirementDriver` to `OperativeScenario`.	`MemoRelationship`
`ImpactsSafety`	`connection def`	Typed relationship from `MemoPart` to `RiskItem`.	`MemoRelationship`
`HasSecurityProperty`	`connection def`	Typed relationship from `CybersecurityAsset` to `SecurityProperty`.	`MemoRelationship`
`ExposesAsset`	`connection def`	Typed relationship from `AttackSurface` to `CybersecurityAsset`.	`MemoRelationship`
`AttributedToThreatActor`	`connection def`	Typed relationship from `Threat` to `ThreatActor`.	`MemoRelationship`
`UsesAttackTechnique`	`connection def`	Typed relationship from `Threat` to `AttackTechnique`.	`MemoRelationship`
`IncludesAttackTechnique`	`connection def`	Typed relationship from `AttackPath` to `AttackTechnique`.	`MemoRelationship`
`RealizesCyberHazard`	`connection def`	Typed relationship from `Threat` to `CyberHazard`.	`MemoRelationship`
`AssessesCyberRisk`	`connection def`	Typed relationship from `CyberRiskAssessment` to `CyberRisk`.	`MemoRelationship`
`IdentifiesVulnerability`	`connection def`	Typed relationship from `SecurityFinding` to `Vulnerability`.	`MemoRelationship`
`AffectsSBOMEntry`	`connection def`	Typed relationship from `Vulnerability` to `SBOMEntry`.	`MemoRelationship`
`DemonstratesAttackPath`	`connection def`	Typed relationship from `SecurityFinding` to `AttackPath`.	`MemoRelationship`
`SupportsMitigationEffectiveness`	`connection def`	Typed relationship from `MemoEvidence` to `CyberMitigation`.	`MemoRelationship`
`ConditionsCyberElement`	`connection def`	Typed relationship from `CybersecurityAssumption` to `any element`.	`MemoRelationship`
`MonitorsSBOMEntry`	`connection def`	Typed relationship from `PostmarketProcess` to `SBOMEntry`.	`MemoRelationship`

CybersecurityAsset¶

part def CybersecurityAsset specializes MemoPart

Property	Value
Description	Cybersecurity asset definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_cybersecurity`

AttackSurface¶

part def AttackSurface specializes MemoPart

Property	Value
Description	Attack surface definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_cybersecurity`

Threat¶

part def Threat specializes RiskDriver

Property	Value
Description	Threat definition specializing `RiskDriver`.
Kind	`part def`
Abstract	No
Specializes	`RiskDriver`
Owning package	`memo_assurance_cybersecurity`

Vulnerability¶

item def Vulnerability specializes RiskItem

Property	Value
Description	Vulnerability definition specializing `RiskItem`.
Kind	`item def`
Abstract	No
Specializes	`RiskItem`
Owning package	`memo_assurance_cybersecurity`

CyberHazard¶

item def CyberHazard specializes Hazard

Property	Value
Description	Cyber hazard definition specializing `Hazard`.
Kind	`item def`
Abstract	No
Specializes	`Hazard`
Owning package	`memo_assurance_cybersecurity`

CyberRisk¶

part def CyberRisk specializes Risk

Property	Value
Description	Cyber risk definition specializing `Risk`.
Kind	`part def`
Abstract	No
Specializes	`Risk`
Owning package	`memo_assurance_cybersecurity`

CyberMitigation¶

part def CyberMitigation specializes RiskControlMeasure

Property	Value
Description	Cyber mitigation definition specializing `RiskControlMeasure`.
Kind	`part def`
Abstract	No
Specializes	`RiskControlMeasure`
Owning package	`memo_assurance_cybersecurity`

SecurityRequirement¶

requirement def SecurityRequirement :> Requirement

Property	Value
Description	Security requirement definition specializing `Requirement`.
Kind	`requirement def`
Abstract	No
Specializes	`Requirement`
Owning package	`memo_assurance_cybersecurity`

TrustBoundary¶

part def TrustBoundary specializes InterfaceElement

Property	Value
Description	Trust boundary definition specializing `InterfaceElement`.
Kind	`part def`
Abstract	No
Specializes	`InterfaceElement`
Owning package	`memo_assurance_cybersecurity`

ThreatActorKind¶

enum def ThreatActorKind

Property	Value
Description	Controlled values for threat actor: `insider`, `serviceTechnician`, `opportunistic`, `cybercriminal`, `nationState`, `supplyChain`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

ThreatCapabilityKind¶

enum def ThreatCapabilityKind

Property	Value
Description	Controlled values for threat capability: `low`, `moderate`, `high`, `advanced`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

ThreatAccessKind¶

enum def ThreatAccessKind

Property	Value
Description	Controlled values for threat access: `physical`, `local`, `network`, `remote`, `supplyChain`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

AttackTechniqueFrameworkKind¶

enum def AttackTechniqueFrameworkKind

Property	Value
Description	Controlled values for attack technique framework: `mitreAttackIcs`, `mitreEmb3d`, `capec`, `other`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

SecurityObjectiveKind¶

enum def SecurityObjectiveKind

Property	Value
Description	Controlled values for security objective: `confidentiality`, `integrity`, `availability`, `authenticity`, `accountability`, `privacy`, `safety`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

CyberAssumptionValidityKind¶

enum def CyberAssumptionValidityKind

Property	Value
Description	Controlled values for cyber assumption validity: `valid`, `reviewDue`, `invalid`, `retired`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

VulnerabilityDispositionKind¶

enum def VulnerabilityDispositionKind

Property	Value
Description	Controlled values for vulnerability disposition: `open`, `mitigated`, `accepted`, `closed`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

SecurityFindingStatusKind¶

enum def SecurityFindingStatusKind

Property	Value
Description	Controlled values for security finding status: `open`, `inRemediation`, `accepted`, `closed`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

PostmarketProcessKind¶

enum def PostmarketProcessKind

Property	Value
Description	Controlled values for postmarket process: `monitoring`, `vulnerabilityDisclosure`, `patching`, `incidentResponse`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

CyberRiskAssessmentStageKind¶

enum def CyberRiskAssessmentStageKind

Property	Value
Description	Controlled values for cyber risk assessment stage: `inherent`, `residual`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

ThreatActor¶

part def ThreatActor specializes MemoPart

Property	Value
Description	Threat actor definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_cybersecurity`

AttackTechnique¶

part def AttackTechnique specializes MemoPart

Property	Value
Description	Attack technique definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_cybersecurity`

SecurityProperty¶

part def SecurityProperty specializes MemoPart

Property	Value
Description	Security property definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_cybersecurity`

CybersecurityAssumption¶

part def CybersecurityAssumption specializes MemoPart

Property	Value
Description	Cybersecurity assumption definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_cybersecurity`

AttackPath¶

action def AttackPath specializes OperativeScenario

Property	Value
Description	The path's narrative is the inherited `pathSummary`.
Kind	`action def`
Abstract	No
Specializes	`OperativeScenario`
Owning package	`memo_assurance_cybersecurity`

SecurityAssessmentMethodKind¶

enum def SecurityAssessmentMethodKind

Property	Value
Description	Controlled values for security assessment method: `penetrationTest`, `sast`, `dast`, `sca`.
Kind	`enum def`
Abstract	No
Specializes	—
Owning package	`memo_assurance_cybersecurity`

SecurityAssessmentCase¶

verification def SecurityAssessmentCase :> VerificationCase

Property	Value
Description	Security assessment case definition specializing `VerificationCase`.
Kind	`verification def`
Abstract	No
Specializes	`VerificationCase`
Owning package	`memo_assurance_cybersecurity`

SecurityFinding¶

part def SecurityFinding specializes MemoEvidence

Property	Value
Description	Security finding definition specializing `MemoEvidence`.
Kind	`part def`
Abstract	No
Specializes	`MemoEvidence`
Owning package	`memo_assurance_cybersecurity`

SecurityAssessmentReport¶

part def SecurityAssessmentReport specializes MemoEvidence

Property	Value
Description	Security assessment report definition specializing `MemoEvidence`.
Kind	`part def`
Abstract	No
Specializes	`MemoEvidence`
Owning package	`memo_assurance_cybersecurity`

PostmarketProcess¶

action def PostmarketProcess specializes MemoAction

Property	Value
Description	Postmarket process definition specializing `MemoAction`.
Kind	`action def`
Abstract	No
Specializes	`MemoAction`
Owning package	`memo_assurance_cybersecurity`

CyberRiskAssessment¶

part def CyberRiskAssessment specializes MemoPart

Property	Value
Description	Cyber risk assessment definition specializing `MemoPart`.
Kind	`part def`
Abstract	No
Specializes	`MemoPart`
Owning package	`memo_assurance_cybersecurity`

ThreatenedBy¶

connection def ThreatenedBy :> MemoRelationship

Property	Value
Description	Typed relationship from `CybersecurityAsset` to `Threat`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

Exploits¶

connection def Exploits :> MemoRelationship

Property	Value
Description	Typed relationship from `Threat` to `Vulnerability`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

RealizedByScenario¶

connection def RealizedByScenario :> MemoRelationship

Property	Value
Description	Typed relationship from `RequirementDriver` to `OperativeScenario`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

ImpactsSafety¶

connection def ImpactsSafety :> MemoRelationship

Property	Value
Description	Typed relationship from `MemoPart` to `RiskItem`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

HasSecurityProperty¶

connection def HasSecurityProperty :> MemoRelationship

Property	Value
Description	Typed relationship from `CybersecurityAsset` to `SecurityProperty`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

ExposesAsset¶

connection def ExposesAsset :> MemoRelationship

Property	Value
Description	Typed relationship from `AttackSurface` to `CybersecurityAsset`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

AttributedToThreatActor¶

connection def AttributedToThreatActor :> MemoRelationship

Property	Value
Description	Typed relationship from `Threat` to `ThreatActor`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

UsesAttackTechnique¶

connection def UsesAttackTechnique :> MemoRelationship

Property	Value
Description	Typed relationship from `Threat` to `AttackTechnique`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

IncludesAttackTechnique¶

connection def IncludesAttackTechnique :> MemoRelationship

Property	Value
Description	Typed relationship from `AttackPath` to `AttackTechnique`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

RealizesCyberHazard¶

connection def RealizesCyberHazard :> MemoRelationship

Property	Value
Description	Typed relationship from `Threat` to `CyberHazard`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

AssessesCyberRisk¶

connection def AssessesCyberRisk :> MemoRelationship

Property	Value
Description	Typed relationship from `CyberRiskAssessment` to `CyberRisk`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

IdentifiesVulnerability¶

connection def IdentifiesVulnerability :> MemoRelationship

Property	Value
Description	Typed relationship from `SecurityFinding` to `Vulnerability`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

AffectsSBOMEntry¶

connection def AffectsSBOMEntry :> MemoRelationship

Property	Value
Description	Typed relationship from `Vulnerability` to `SBOMEntry`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

DemonstratesAttackPath¶

connection def DemonstratesAttackPath :> MemoRelationship

Property	Value
Description	Typed relationship from `SecurityFinding` to `AttackPath`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

SupportsMitigationEffectiveness¶

connection def SupportsMitigationEffectiveness :> MemoRelationship

Property	Value
Description	Typed relationship from `MemoEvidence` to `CyberMitigation`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

ConditionsCyberElement¶

connection def ConditionsCyberElement :> MemoRelationship

Property	Value
Description	Typed relationship from `CybersecurityAssumption` to `any element`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

MonitorsSBOMEntry¶

connection def MonitorsSBOMEntry :> MemoRelationship

Property	Value
Description	Typed relationship from `PostmarketProcess` to `SBOMEntry`.
Kind	`connection def`
Abstract	No
Specializes	`MemoRelationship`
Owning package	`memo_assurance_cybersecurity`

Source¶

assurance/cybersecurity/memo_cybersecurity.sysml

// Cybersecurity (FDA premarket cybersecurity guidance 2023, AAMI TIR57).
// What an element is linked to is a relation, not a string naming it: a
// security requirement's source threat is `DerivesCyberRequirement`, not a
// `derivedFromThreat` id, and an asset's threats are `ThreatenedBy`. Which
// layer an element belongs to is its package; an asset or a vulnerability
// that lives in the architecture points at that element with a typed ref.
// `ThreatenedBy` lives here rather than in memo_core_relationships because
// its ends are typed against CybersecurityAsset and Threat.
package memo_assurance_cybersecurity {
    private import Metaobjects::SemanticMetadata;
    private import ScalarValues::*;
    private import memo_core_relationships::*;   // MemoRelationship

    private import memo_core_common::*;
    private import memo_core_enumerations::*;
    private import memo_assurance_requirements::*;
    private import memo_assurance_safety_risk::*;
    private import memo_assurance_verification_validation::*;
    private import memo_architecture_operational_scenarios::*;
    private import memo_architecture_implementation_software_structure::SBOMEntry;

    part def CybersecurityAsset specializes MemoPart {
        attribute assetKind : AssetKind;
        attribute confidentialityNeed : SecurityNeedKind;
        attribute integrityNeed : SecurityNeedKind;
        attribute availabilityNeed : SecurityNeedKind;
        attribute privacyRelevant : Boolean;
        attribute safetyRelevant : Boolean;
        attribute assetOwner : String;
        attribute classification : String;
        // The architecture elements that store, process or are this asset.
        ref holder : MemoPart[0..*];
    }

    part def AttackSurface specializes MemoPart {
        attribute entryPointKind : InterfaceKind;
        attribute exposureLevel : String;
        attribute reachableFrom : String;
        attribute authenticationExpected : Boolean;
    }

    part def Threat specializes RiskDriver {
        attribute threatCategory : ThreatCategoryKind;
        attribute attackVector : String;
        attribute threatSource : String;
        attribute precondition : String;
        attribute affectedConcern : ConcernKind;
    }

    item def Vulnerability specializes RiskItem {
        attribute weakness : String;
        attribute exploitability : String;
        attribute discoveryMethod : String;
        attribute cweReference : String;
        attribute cveReference : String;
        attribute remediable : Boolean;
        attribute vulnerabilityDisposition : VulnerabilityDispositionKind;
        // CVSS v3.1 quantitative rating — the core output of a vulnerability
        // analysis (e.g. RSK-00058). `cvssBaseScore` is the 0.0-10.0 numeric
        // score; `cvssVector` the source vector string (AV:.../AC:.../...).
        attribute cvssBaseScore : Real;
        attribute cvssVector : String;
        // The architecture elements the weakness is in.
        ref affectedElement : MemoPart[0..*];
    }

    item def CyberHazard specializes Hazard {
        attribute securityImpact : String;
        attribute safetyImpact : String;
        attribute privacyImpact : String;
        attribute operationalImpact : String;
    }

    part def CyberRisk specializes Risk {
        attribute exploitabilityEstimate : String;
        attribute attackComplexity : String;
        attribute detectability : DetectionKind;
        attribute essentialPerformanceImpact : String;
        attribute patientSafetyContribution : String;
    }

    part def CyberMitigation specializes RiskControlMeasure {
        attribute cyberControlKind : CyberControlKind;
        attribute securityMechanism : String;
        attribute verificationExpectation : String;
        attribute hardeningScope : String;
    }

    requirement def SecurityRequirement :> Requirement {
        attribute securityObjective : String;
    }

    part def TrustBoundary specializes InterfaceElement {
        attribute boundaryType : String;
        attribute crossingConstraint : String;
        attribute trustAssumption : String;
    }

    // ── Product-security and threat-intelligence extensions ─────────
    enum def ThreatActorKind {
        enum insider;
        enum serviceTechnician;
        enum opportunistic;
        enum cybercriminal;
        enum nationState;
        enum supplyChain;
    }
    enum def ThreatCapabilityKind {
        enum low;
        enum moderate;
        enum high;
        enum advanced;
    }
    enum def ThreatAccessKind {
        enum physical;
        enum local;
        enum network;
        enum remote;
        enum supplyChain;
    }
    enum def AttackTechniqueFrameworkKind {
        enum mitreAttackIcs;
        enum mitreEmb3d;
        enum capec;
        enum other;
    }
    enum def SecurityObjectiveKind {
        enum confidentiality;
        enum integrity;
        enum availability;
        enum authenticity;
        enum accountability;
        enum privacy;
        enum safety;
    }
    enum def CyberAssumptionValidityKind {
        enum valid;
        enum reviewDue;
        enum invalid;
        enum retired;
    }
    enum def VulnerabilityDispositionKind {
        enum open;
        enum mitigated;
        enum accepted;
        enum closed;
    }
    enum def SecurityFindingStatusKind {
        enum open;
        enum inRemediation;
        enum accepted;
        enum closed;
    }
    enum def PostmarketProcessKind {
        enum monitoring;
        enum vulnerabilityDisclosure;
        enum patching;
        enum incidentResponse;
    }
    enum def CyberRiskAssessmentStageKind {
        enum inherent;
        enum residual;
    }

    part def ThreatActor specializes MemoPart {
        attribute actorKind : ThreatActorKind;
        attribute motivation : String;
        attribute capability : ThreatCapabilityKind;
        attribute accessMode : ThreatAccessKind;
        attribute organization : String;
    }

    part def AttackTechnique specializes MemoPart {
        attribute framework : AttackTechniqueFrameworkKind;
        attribute externalId : String;
        attribute tactic : String;
        attribute platform : String;
        attribute techniqueVersion : String;
    }

    part def SecurityProperty specializes MemoPart {
        attribute objectiveKind : SecurityObjectiveKind;
        attribute impactLevel : CriticalityKind;
        attribute propertyRationale : String;
    }

    part def CybersecurityAssumption specializes MemoPart {
        attribute statement : String;
        attribute owner : String;
        attribute reviewDate : String;
        attribute expirationDate : String;
        attribute validity : CyberAssumptionValidityKind;
    }

    // The path's narrative is the inherited `pathSummary`.
    action def AttackPath specializes OperativeScenario {
        attribute entryPoint : String;
        attribute attackGoal : String;
    }

    // Security assessment: a case is the planned activity (penetration test,
    // static or dynamic analysis, composition analysis), a report is the
    // evidence it produced, and a finding is one result in the report.
    // The case is a verification case: it checks the security requirements,
    // and `ProducesEvidence` already links a verification case to what it
    // produced. The method is stated once, on the case; a finding is one
    // type whose method-specific descriptors are optional, as Interface's
    // are. A finding is traced to its vulnerability by
    // `IdentifiesVulnerability`, and from there to the SBOM entry by
    // `AffectsSBOMEntry`.
    enum def SecurityAssessmentMethodKind {
        enum penetrationTest;
        enum sast;
        enum dast;
        enum sca;
    }
    verification def SecurityAssessmentCase :> VerificationCase {
        attribute assessmentMethod : SecurityAssessmentMethodKind;
        attribute assessmentScope : String;
        attribute toolName : String;
        attribute toolVersion : String;
    }
    part def SecurityFinding specializes MemoEvidence {
        attribute findingIdentifier : String;
        attribute severity : CriticalityKind;
        attribute cvssBaseScore : Real;
        attribute cvssVector : String;
        attribute findingStatus : SecurityFindingStatusKind;
        attribute retestDate : String;
        // method-specific (optional)
        attribute weaknessReference : String[0..1];   // CWE identifier (SAST)
        attribute sourceLocation : String[0..1];      // file and line (SAST)
        attribute testedEndpoint : String[0..1];      // URL or interface (DAST)
    }
    part def SecurityAssessmentReport specializes MemoEvidence {
        attribute reportDate : String;
        attribute assessor : String;
        part finding : SecurityFinding[0..*];
    }

    action def PostmarketProcess specializes MemoAction {
        attribute processKind : PostmarketProcessKind;
        attribute owner : String;
        attribute cadence : String;
        attribute serviceLevelTarget : String;
    }

    // A CyberRisk remains the stable risk identity. Assessments record its
    // pre-control (inherent) and post-control (residual) states without
    // duplicating the risk itself.
    part def CyberRiskAssessment specializes MemoPart {
        attribute assessmentStage : CyberRiskAssessmentStageKind;
        attribute probabilityEstimate : ProbabilityKind;
        attribute severityEstimate : SeverityKind;
        attribute riskLevel : CriticalityKind;
        attribute acceptability : RiskAcceptabilityKind;
        attribute controlsAppliedSummary : String;
        attribute assessmentDate : String;
        attribute assessor : String;
        attribute approver : String;
    }

    // ── Relations owned by this package ─────────────────────────────
    connection def ThreatenedBy :> MemoRelationship {
        attribute threatRole : String;
        end protectedAsset : CybersecurityAsset :>> source;
        end threat : Threat :>> target;
    }
    abstract connection threatenedByLinks : ThreatenedBy[*];
    metadata def <threatenedBy> ThreatenedByMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = threatenedByLinks meta SysML::Usage;
    }
    connection def Exploits :> MemoRelationship {
        end threat : Threat :>> source;
        end enablingVulnerability : Vulnerability :>> target;
    }
    abstract connection exploitsLinks : Exploits[*];
    metadata def <exploits> ExploitsMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = exploitsLinks meta SysML::Usage;
    }
    connection def RealizedByScenario :> MemoRelationship {
        end realizedThreat : RequirementDriver :>> source;
        end scenario : OperativeScenario :>> target;
    }
    abstract connection realizedByScenarioLinks : RealizedByScenario[*];
    metadata def <realizedByScenario> RealizedByScenarioMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = realizedByScenarioLinks meta SysML::Usage;
    }
    connection def ImpactsSafety :> MemoRelationship {
        attribute tracePurpose : String;
        end cyberElement : MemoPart :>> source;
        end safetyElement : RiskItem :>> target;
    }
    abstract connection impactsSafetyLinks : ImpactsSafety[*];
    metadata def <impactsSafety> ImpactsSafetyMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = impactsSafetyLinks meta SysML::Usage;
    }

    // ── Product-security and threat-intelligence relations ──────────

    connection def HasSecurityProperty :> MemoRelationship {
        end characterizedAsset : CybersecurityAsset :>> source;
        end securityProperty : SecurityProperty :>> target;
    }
    abstract connection hasSecurityPropertyLinks : HasSecurityProperty[*];
    metadata def <hasSecurityProperty> HasSecurityPropertyMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = hasSecurityPropertyLinks meta SysML::Usage;
    }

    connection def ExposesAsset :> MemoRelationship {
        end attackSurface : AttackSurface :>> source;
        end exposedAsset : CybersecurityAsset :>> target;
    }
    abstract connection exposesAssetLinks : ExposesAsset[*];
    metadata def <exposesAsset> ExposesAssetMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = exposesAssetLinks meta SysML::Usage;
    }

    connection def AttributedToThreatActor :> MemoRelationship {
        end attributedThreat : Threat :>> source;
        end threatActor : ThreatActor :>> target;
    }
    abstract connection attributedToThreatActorLinks : AttributedToThreatActor[*];
    metadata def <attributedToThreatActor> AttributedToThreatActorMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = attributedToThreatActorLinks meta SysML::Usage;
    }

    connection def UsesAttackTechnique :> MemoRelationship {
        end realizedThreat : Threat :>> source;
        end attackTechnique : AttackTechnique :>> target;
    }
    abstract connection usesAttackTechniqueLinks : UsesAttackTechnique[*];
    metadata def <usesAttackTechnique> UsesAttackTechniqueMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = usesAttackTechniqueLinks meta SysML::Usage;
    }

    connection def IncludesAttackTechnique :> MemoRelationship {
        end attackPath : AttackPath :>> source;
        end attackTechnique : AttackTechnique :>> target;
    }
    abstract connection includesAttackTechniqueLinks : IncludesAttackTechnique[*];
    metadata def <includesAttackTechnique> IncludesAttackTechniqueMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = includesAttackTechniqueLinks meta SysML::Usage;
    }

    connection def RealizesCyberHazard :> MemoRelationship {
        end realizedThreat : Threat :>> source;
        end resultingCyberHazard : CyberHazard :>> target;
    }
    abstract connection realizesCyberHazardLinks : RealizesCyberHazard[*];
    metadata def <realizesCyberHazard> RealizesCyberHazardMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = realizesCyberHazardLinks meta SysML::Usage;
    }

    connection def AssessesCyberRisk :> MemoRelationship {
        end assessment : CyberRiskAssessment :>> source;
        end assessedRisk : CyberRisk :>> target;
    }
    abstract connection assessesCyberRiskLinks : AssessesCyberRisk[*];
    metadata def <assessesCyberRisk> AssessesCyberRiskMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = assessesCyberRiskLinks meta SysML::Usage;
    }

    connection def IdentifiesVulnerability :> MemoRelationship {
        end finding : SecurityFinding :>> source;
        end identifiedVulnerability : Vulnerability :>> target;
    }
    abstract connection identifiesVulnerabilityLinks : IdentifiesVulnerability[*];
    metadata def <identifiesVulnerability> IdentifiesVulnerabilityMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = identifiesVulnerabilityLinks meta SysML::Usage;
    }

    connection def AffectsSBOMEntry :> MemoRelationship {
        end vulnerability : Vulnerability :>> source;
        end affectedComponent : SBOMEntry :>> target;
    }
    abstract connection affectsSBOMEntryLinks : AffectsSBOMEntry[*];
    metadata def <affectsSBOMEntry> AffectsSBOMEntryMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = affectsSBOMEntryLinks meta SysML::Usage;
    }

    connection def DemonstratesAttackPath :> MemoRelationship {
        end finding : SecurityFinding :>> source;
        end demonstratedPath : AttackPath :>> target;
    }
    abstract connection demonstratesAttackPathLinks : DemonstratesAttackPath[*];
    metadata def <demonstratesAttackPath> DemonstratesAttackPathMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = demonstratesAttackPathLinks meta SysML::Usage;
    }

    connection def SupportsMitigationEffectiveness :> MemoRelationship {
        end supportingEvidence : MemoEvidence :>> source;
        end supportedMitigation : CyberMitigation :>> target;
    }
    abstract connection supportsMitigationEffectivenessLinks : SupportsMitigationEffectiveness[*];
    metadata def <supportsMitigationEffectiveness> SupportsMitigationEffectivenessMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = supportsMitigationEffectivenessLinks meta SysML::Usage;
    }

    connection def ConditionsCyberElement :> MemoRelationship {
        end governingAssumption : CybersecurityAssumption :>> source;
        end conditionedElement :>> target;
    }
    abstract connection conditionsCyberElementLinks : ConditionsCyberElement[*];
    metadata def <conditionsCyberElement> ConditionsCyberElementMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = conditionsCyberElementLinks meta SysML::Usage;
    }

    connection def MonitorsSBOMEntry :> MemoRelationship {
        end postmarketProcess : PostmarketProcess :>> source;
        end monitoredComponent : SBOMEntry :>> target;
    }
    abstract connection monitorsSBOMEntryLinks : MonitorsSBOMEntry[*];
    metadata def <monitorsSBOMEntry> MonitorsSBOMEntryMetadata :> SemanticMetadata {
        :> annotatedElement : SysML::ConnectionDefinition;
        :> annotatedElement : SysML::ConnectionUsage;
        :>> baseType = monitorsSBOMEntryLinks meta SysML::Usage;
    }
}